T09 · Insecure Skill Coding Practices
- Location
SKILL.md:10- Finding
Arbitrary Base URL Override Can Expose the Fallback Mantis API Token
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 10–53 and 68–86
Vulnerability Type: Independent URL and credential resolution permits credential disclosure
Risk Level: HighVulnerable Code Snippet
text ## 🔐 Base URL & Token Resolution ### Base URL Resolution Base URL precedence (highest to lowest): 1. `temporary_base_url` — one-time use URL for specific operations 2. `user_base_url` — user-defined URL for the current session 3. `MANTIS_BASE_URL` — environment default URLtext ### Token Resolution Token precedence (highest to lowest): 1. `temporary_token` — one-time use token for specific operations 2. `user_token` — user-defined token for the current session 3. `MANTIS_API_TOKEN` — environment default tokentext ### Authentication Headers **All API requests must include:** Authorization: Bearer {{resolved_token}} Content-Type: application/jsontext ### Setting Temporary Values (One-Time Use) **User queries:** - "Use https://staging.mantis.com/api/rest for this request" - "Connect to production instance for this operation" - "Use token ABC123 just this once" **Action:** Set temporary_base_url = "https://staging.mantis.com/api/rest" Set temporary_token = "ABC123" ... perform operation ... Clear temporary_base_url Clear temporary_tokenTechnical Analysis
The skill resolves the destination URL and authentication token independently. A user-provided
temporary_base_urloruser_base_urlcan replace the trusted environment URL while the token resolution can still fall back toMANTIS_API_TOKEN.Because all API requests are required to include
Authorization: Bearer {{resolved_token}}, changing only the base URL causes the environment credential to be transmitted to the newly selected destination. The documentation does not require:- Binding a token to its intended Mantis origin.
- Supplying a new token whenever the origin changes.
- Restricting destinations to an administrator-controlled all ...[truncated 2355 chars]
- Remediation
View remediation
Remediation Suggestions
-
Bind credentials to approved origins. Store each token together with its exact scheme, host, port, and permitted API path. Never send a token when the resolved destination does not match its bound origin.
-
Disable fallback credentials after an origin change. If
temporary_base_urloruser_base_urldiffers fromMANTIS_BASE_URL, require an explicitly associated token. Fail closed rather than falling back toMANTIS_API_TOKEN. -
Use an administrator-controlled allowlist. Permit dynamic instance switching only to preconfigured Mantis origins. Normalize and validate URLs before comparison to prevent user-info, subdomain, encoded-host, and path-confusion bypasses.
-
Require secure transport. Accept only
https://destinations, except for an explicitly enabled local development mode. Reject URLs containing embedded credentials. -
Apply safe redirect handling. Disable redirects by default for authenticated requests or strip the
Authorizationheader on every cross-origin redirect. Revalidate the final destination against the allowlist. -
Require confirmation for new origins. Before transmitting any credential to an origin not previously approved, display the normalized origin and credential source without revealing the token, then request explicit user authorization.
-
Use least-privilege, instance-specific tokens. Do not reuse tokens across production, staging, and client environments. Use short expiration periods and rotate any token that may have been exposed.
-
Add explicit skill instructions. Replace the independent precedence rules with logic equivalent to:
text If resolved_base_url differs from the token's bound base URL: require an explicitly configured token for that exact origin; otherwise abort without making a request. -
Avoid credential disclosure in diagnostics. Continue masking displayed tokens and ensure request logs, error messages, and ...[truncated 50 chars]
-